> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/android-appsec/fundamenteals/apk-and-app-components.md).
# APK & App Components
## **What is an APK file**
An Android Application Package (APK) is the file format used to distribute and install applications on Android devices. It contains all the necessary components for an app to be installed and run on an Android device, including code (in the form of dex files), resources, assets, manifest file, and certificates.
### **APK File Structure**
* **Code (classes.dex):** This section includes the compiled Java or Kotlin code of the application in the form of .dex files. These files are optimized for the Android runtime (ART or Dalvik) and contain the executable code necessary to run the app.
* **Manifest File (AndroidManifest.xml):** The AndroidManifest.xml file describes essential information about the application to the Android system. It includes the app’s package name, version, permissions required, entry points (activities, services, receivers), and more.
* **Resources (res):** This section contains non-code resources used by the application, such as images, XML layouts, strings, and other assets. These resources are compiled into a binary format and can be accessed by the app at runtime.
* **Libraries:** If the application uses any third-party libraries or dependencies, they are bundled within the APK. This ensures that the app has access to all necessary code when installed on a device, even if the device doesn’t have those libraries installed separately.
* **Assets (assets):** These are raw files that the app can access using a file manager. They are stored in the assets/ directory within the APK and can include fonts, sounds, videos, and other files.
* **Pre-compiled Resources (resources.arsc):** This file contains pre-compiled resources that the Android system can quickly load at runtime. It helps improve the performance of resource loading in the app.
* **Certificates (CERT.RSA and CERT.SF):** Before an APK can be installed on a device, it must be signed with a cryptographic signature. The CERT.RSA and CERT.SF files contain the certificates used to sign the APK, ensuring its integrity and authenticity.
***
## Android app components
Android app components are the fundamental building blocks of an Android application. They serve as the entry points for the system to interact with the app. While not all components are directly accessible to the user, they work together and depend on each other to define the app’s behaviour. Each component is distinct and plays a specific role, contributing to the overall functionality and structure of the app.
***There are four types of app components:***
* **Activities:** Activities represent the UI of an application. They are responsible for presenting the user interface and handling user interactions. An app usually consists of multiple activities that work together to form a complete user experience.
* **Services:** Services are background processes that run without a UI. They are used for tasks that need to continue running even when the app is not in the foreground, such as playing music, fetching data from the internet, or performing other long-running operations.
* **Broadcast Receivers:** Broadcast Receivers can be used to handle system-wide broadcast messages, which can include notifications. However, they are not limited to handling notifications. Broadcast Receivers can also respond to other types of system events, such as changes in network connectivity, the device’s battery level, or the device’s screen turning on or off.
* **Content Providers:** Content Providers in Android are used to manage access to structured data, allowing different applications to securely share data. They typically store data in a SQLite database, but they can also provide access to other types of data, such as files or web resources. They are commonly used in Contacts, Messaging, and Media Player apps.